2024 CVEs (page 147)
Page 147 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45737 | Medium | 4.3 | 2024-10-14 | In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that… |
CVE-2024-45736 | Medium | 6.5 | 2024-10-14 | In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privil… |
CVE-2024-45735 | Medium | 4.3 | 2024-10-14 | In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a l… |
CVE-2024-45734 | Medium | 4.3 | 2024-10-14 | In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could view images on the ma… |
CVE-2024-45733 | High | 8.8 | 2024-10-14 | In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a R… |
CVE-2024-45732 | High | 7.1 | 2024-10-14 | In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 an… |
CVE-2024-45731 | High | 8.0 | 2024-10-14 | In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could wri… |
CVE-2024-8184 | Medium | 5.9 | 2024-10-14 | There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service… |
CVE-2024-6763 | Low | 3.7 | 2024-10-14 | Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The Htt… |
CVE-2024-6762 | Low | 3.1 | 2024-10-14 | Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory. |
CVE-2024-48153 | Critical | 9.8 | 2024-10-14 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_subconfig funct… |
CVE-2024-48150 | Critical | 9.8 | 2024-10-14 | D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_451208 function. |
CVE-2024-41997 | Medium | 6.6 | 2024-10-14 | An issue was discovered in version of Warp Terminal prior to 2024.07.18 (v0.2024.07.16.08.02). A command injection vulnerability exists in the Docker integrati… |
CVE-2024-9823 | Medium | 5.3 | 2024-10-14 | There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the s… |
CVE-2024-48259 | High | 7.3 | 2024-10-14 | Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign. |
CVE-2024-48257 | Critical | 9.8 | 2024-10-14 | Wavelog 1.8.5 allows Oqrs_model.php get_worked_modes station_id SQL injectioin. |
CVE-2024-48251 | Critical | 9.8 | 2024-10-14 | Wavelog 1.8.5 allows Activated_gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode. |
CVE-2024-48249 | High | 7.3 | 2024-10-14 | Wavelog 1.8.5 allows Gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode. |
CVE-2024-9936 | Medium | 6.5 | 2024-10-14 | When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitable crash. This vuln… |
CVE-2024-8602 | | 2024-10-14 | When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE (XML External E… | |
CVE-2024-7847 | High | 7.7 | 2024-10-14 | VULNERABILITY DETAILS Rockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabi… |
CVE-2024-48255 | Critical | 9.8 | 2024-10-14 | Cloudlog 2.6.15 allows Oqrs.php get_station_info station_id SQL injection. |
CVE-2024-48253 | Critical | 9.8 | 2024-10-14 | Cloudlog 2.6.15 allows Oqrs.php delete_oqrs_line id SQL injection. |
CVE-2024-48120 | Medium | 5.4 | 2024-10-14 | X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript code into the "Name"… |
CVE-2024-48119 | Medium | 5.4 | 2024-10-14 | Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. Authenticated users can inject arbitrary HTML. |
CVE-2024-9139 | High | 7.2 | 2024-10-14 | The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrary code. |
CVE-2024-9137 | Critical | 9.4 | 2024-10-14 | The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute s… |
CVE-2024-46911 | Medium | 4.7 | 2024-10-14 | Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trust… |
CVE-2024-43701 | High | 7.8 | 2024-10-14 | Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU. |
CVE-2024-38863 | High | 7.5 | 2024-10-14 | Exposure of CSRF tokens in query parameters on specific requests in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35 and <2.1.0p48 could lead to a leak of… |
CVE-2024-38862 | Medium | 4.4 | 2024-10-14 | Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35, <2.1.0p48 and <=2.0.0p39 (EOL) causes SNMP and IMPI s… |
CVE-2024-9924 | Critical | 9.8 | 2024-10-14 | The fix for CVE-2024-26261 was incomplete, and and the specific package for OAKlouds from Hgiga remains at risk. Unauthenticated remote attackers still can dow… |
CVE-2024-9923 | Medium | 4.9 | 2024-10-14 | The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with administrator privileges to move arbitr… |
CVE-2024-49214 | Medium | 5.3 | 2024-10-14 | QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass th… |
CVE-2024-9922 | High | 7.5 | 2024-10-14 | The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerabilit… |
CVE-2024-9921 | Critical | 9.8 | 2024-10-14 | The Team+ from TEAMPLUS TECHNOLOGY does not properly validate specific page parameter, allowing unauthenticated remote attackers to inject arbitrary SQL comman… |
CVE-2024-7099 | Critical | 9.8 | 2024-10-13 | netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injec… |
CVE-2024-9918 | Medium | 4.7 | 2024-10-13 | A vulnerability has been found in HuangDou UTCMS V9 and classified as critical. This vulnerability affects the function RunSql of the file app/modules/ut-data/… |
CVE-2024-9917 | Medium | 6.3 | 2024-10-13 | A vulnerability, which was classified as critical, was found in HuangDou UTCMS V9. This affects an unknown part of the file app/modules/ut-template/admin/templ… |
CVE-2024-8070 | High | 8.5 | 2024-10-13 | CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that exposes test credentials in the firmware binary |
CVE-2024-9916 | High | 7.3 | 2024-10-13 | A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/mo… |
CVE-2024-9915 | High | 8.8 | 2024-10-13 | A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06. Affected by this vulnerability is the function formVirtualServ of the file /goform… |
CVE-2024-9914 | High | 8.8 | 2024-10-13 | A vulnerability classified as critical has been found in D-Link DIR-619L B1 2.06. Affected is the function formSetWizardSelectMode of the file /goform/formSetW… |
CVE-2024-9913 | High | 8.8 | 2024-10-13 | A vulnerability was found in D-Link DIR-619L B1 2.06. It has been rated as critical. This issue affects the function formSetRoute of the file /goform/formSetRo… |
CVE-2024-9912 | High | 8.8 | 2024-10-13 | A vulnerability was found in D-Link DIR-619L B1 2.06. It has been declared as critical. This vulnerability affects the function formSetQoS of the file /goform/… |
CVE-2024-9911 | High | 8.8 | 2024-10-13 | A vulnerability was found in D-Link DIR-619L B1 2.06. It has been classified as critical. This affects the function formSetPortTr of the file /goform/formSetPo… |
CVE-2024-9910 | High | 8.8 | 2024-10-13 | A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formSetPassword of the file /goform/for… |
CVE-2024-9909 | High | 8.8 | 2024-10-13 | A vulnerability has been found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this vulnerability is the function formSetMuti of the file /g… |
CVE-2024-6959 | High | 7.1 | 2024-10-13 | A vulnerability in parisneo/lollms-webui version 9.8 allows for a Denial of Service (DOS) attack when uploading an audio file. If an attacker appends a large n… |
CVE-2024-9908 | Medium | 5.5 | 2024-10-13 | A vulnerability, which was classified as critical, was found in D-Link DIR-619L B1 2.06. Affected is the function formSetMACFilter of the file /goform/formSetM… |
CVE-2024-9907 | Low | 3.7 | 2024-10-13 | A vulnerability classified as problematic was found in QileCMS up to 1.1.3. This vulnerability affects the function sendEmail of the file /qilecms/user/control… |
CVE-2024-9906 | Low | 3.5 | 2024-10-13 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /admin/?… |
CVE-2024-9905 | Medium | 6.3 | 2024-10-13 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the… |
CVE-2024-9904 | Medium | 4.7 | 2024-10-13 | A vulnerability classified as critical was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This vulnerability affects the function pictureUpload of the… |
CVE-2024-9903 | Medium | 4.7 | 2024-10-12 | A vulnerability classified as critical has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This affects the function fileUpload of the file /admin/… |
CVE-2024-49193 | High | 7.5 | 2024-10-12 | Zendesk before 2024-07-02 allows remote attackers to read ticket history via e-mail spoofing, because Cc fields are extracted from incoming e-mail messages and… |
CVE-2024-9894 | Medium | 6.3 | 2024-10-12 | A vulnerability, which was classified as critical, was found in code-projects Blood Bank System 1.0. Affected is an unknown function of the file reset.php. The… |
CVE-2024-8902 | Medium | 4.3 | 2024-10-12 | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.8 via the render_c… |
CVE-2024-8757 | High | 7.2 | 2024-10-12 | The WP Post Author – Boost Your Blog's Engagement with Author Box, Social Links, Co-Authors, Guest Authors, Post Rating System, and Custom User Registrati… |
CVE-2024-9696 | Medium | 6.4 | 2024-10-12 | The Rescue Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rescue_tab' shortcode in all versions up to, and incl… |
CVE-2024-9595 | Medium | 6.4 | 2024-10-12 | The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the table cell content in all versions up… |
CVE-2024-8915 | Medium | 6.4 | 2024-10-12 | The Category Icon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to ins… |
CVE-2024-8760 | Medium | 5.3 | 2024-10-12 | The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 3.13.6. This makes it p… |
CVE-2024-9756 | Medium | 4.3 | 2024-10-12 | The Order Attachments for WooCommerce plugin for WordPress is vulnerable to unauthorized limited arbitrary file uploads due to a missing capability check on th… |
CVE-2024-9704 | Medium | 6.4 | 2024-10-12 | The Social Sharing (by Danny) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dvk_social_sharing' shortcode in all versions… |
CVE-2024-9047 | Critical | 9.8 | 2024-10-12 | The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This… |
CVE-2024-9824 | Medium | 4.3 | 2024-10-12 | The ImagePress – Image Gallery plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'ip_de… |
CVE-2024-9778 | Medium | 4.3 | 2024-10-12 | The ImagePress – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. This is due to mis… |
CVE-2024-9776 | Medium | 4.4 | 2024-10-12 | The ImagePress – Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.2… |
CVE-2024-9670 | Medium | 6.1 | 2024-10-12 | The 2D Tag Cloud plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL i… |
CVE-2024-9656 | Medium | 6.4 | 2024-10-12 | The Mynx Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.27.8 due t… |
CVE-2024-9187 | Medium | 4.3 | 2024-10-12 | The Read more By Adam plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteRm() function in all versi… |
CVE-2024-7489 | Medium | 4.4 | 2024-10-12 | The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form color parameters… |
CVE-2024-9860 | Medium | 5.4 | 2024-10-12 | The Bridge Core plugin for WordPress is vulnerable to unauthorized modification of data or loss of data due to a missing capability check on the 'import_action… |
CVE-2024-9821 | High | 8.8 | 2024-10-12 | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'stm_wpcf… |
CVE-2024-9592 | Medium | 6.1 | 2024-10-12 | The Easy PayPal Gift Certificate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.3. This is due to missi… |
CVE-2024-45754 | High | 7.2 | 2024-10-11 | An issue was discovered in the centreon-bi-server component in Centreon BI Server 24.04.x before 24.04.3, 23.10.x before 23.10.8, 23.04.x before 23.04.11, and… |
CVE-2024-35522 | High | 8.4 | 2024-10-11 | Netgear EX3700 ' AC750 WiFi Range Extender Essentials Edition before 1.0.0.98 contains an authenticated command injection in operating_mode.cgi via the ap_mode… |
CVE-2024-35517 | High | 8.4 | 2024-10-11 | Netgear XR1000 v1.0.0.64 is vulnerable to command injection in usb_remote_smb_conf.cgi via the share_name parameter. |
CVE-2024-48938 | High | 7.5 | 2024-10-11 | Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows DoS/ReDos via email. Parsing the content of emails where HTML code is copied from Microso… |
CVE-2024-48937 | Medium | 6.1 | 2024-10-11 | Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows XSS. JavaScript code in the short description of the SLA field in Activity Dialogues is e… |
CVE-2024-48788 | High | 7.5 | 2024-10-11 | An issue in YESCAM (com.yescom.YesCam.zwave) 1.0.2 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48772 | Critical | 9.1 | 2024-10-11 | An issue in C-CHIP (com.cchip.cchipamaota) v.1.2.8 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-46468 | High | 7.5 | 2024-10-11 | A Server-Side Request Forgery (SSRF) vulnerability exists in the jpress <= v5.1.1, which can be exploited by an attacker to obtain sensitive information, resul… |
CVE-2024-45184 | Medium | 6.2 | 2024-10-11 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modems with chipset Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330… |
CVE-2024-48787 | Critical | 9.1 | 2024-10-11 | An issue in Revic Optics Revic Ops (us.revic.revicops) 1.12.5 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48786 | Critical | 9.1 | 2024-10-11 | An issue in SWITCHBOT INC SwitchBot (com.theswitchbot.switchbot) 5.0.4 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48784 | Critical | 9.8 | 2024-10-11 | An Incorrect Access Control issue in SAMPMAX com.sampmax.homemax 2.1.2.7 allows a remote attacker to obtain sensitive information via the firmware update proce… |
CVE-2024-48778 | Critical | 9.1 | 2024-10-11 | An issue in GIANT MANUFACTURING CO., LTD RideLink (tw.giant.ridelink) 2.0.7 allows a remote attacker to obtain sensitive information via the firmware update pr… |
CVE-2024-48777 | High | 7.5 | 2024-10-11 | LEDVANCE com.ledvance.smartplus.eu 2.1.10 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48776 | High | 7.5 | 2024-10-11 | An issue in Shelly com.home.shelly 1.0.4 allows a remote attacker to obtain sensitive information via the firmware update process |
CVE-2024-48775 | High | 7.5 | 2024-10-11 | An issue in Plug n Play Camera com.ezset.delaney 1.2.0 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48774 | High | 7.5 | 2024-10-11 | An issue in Fermax Asia Pacific Pte Ltd com.fermax.vida 2.4.6 allows a remote attacker to obtain sensitve information via the firmware update process. |
CVE-2024-48773 | High | 7.5 | 2024-10-11 | An issue in WoFit v.7.2.3 allows a remote attacker to obtain sensitive information via the firmware update process |
CVE-2024-48771 | High | 7.5 | 2024-10-11 | An issue in almando GmbH Almando Play APP (com.almando.play) 1.8.2 allows a remote attacker to obtain sensitive information via the firmware update process |
CVE-2024-48770 | High | 8.2 | 2024-10-11 | An issue in Plug n Play Camera com.wisdomcity.zwave 1.1.0 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48769 | Critical | 9.1 | 2024-10-11 | An issue in BURG-WCHTER KG de.burgwachter.keyapp.app 4.5.0 allows a remote attacker to obtain sensitve information via the firmware update process. |
CVE-2024-48768 | High | 7.5 | 2024-10-11 | An issue in almaodo GmbH appinventor.ai_google.almando_control 2.3.1 allows a remote attacker to obtain sensitive information via the firmware update process |
CVE-2024-47884 | | 2024-10-11 | foxmarks is a CLI read-only interface for Firefox's bookmarks and history. A temporary file was created under the /tmp directory with read permissions for all… | |
CVE-2024-38365 | High | 7.4 | 2024-10-11 | btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement… |